Foreword In recent years, a large amount of software development activity has migrated from the client to the server The client-centric model, in which a client executes complex programs to visualize and manipulate data, is no longer considered appropriate for the majority of enterprise applications The principal reason is deployment—it is a significant hassle to deploy client programs onto a large number of desktops, and to redeploy them whenever the application changes Instead, applications are redesigned to use a web browser as a "terminal" The application itself resides on the server, formatting data for the user as web pages and processing the responses that the user fills into web forms If you set out to develop a web application, you need to choose a technology that has several important characteristics You need to generate large amounts of dynamic HTML conveniently You require access to databases and other services The technology must provide an architectural foundation for performance and stability Finally, you must be able to partition your program logic in a way that allows for future growth and maintainability The first web applications used the CGI (Common Gateway Interface) mechanism and a collection of server-side scripts, typically written in Perl, but occasionally in C, Python, PHP or other languages There are numerous problems with this approach The CGI mechanism does not scale well since every web request spawns a new server process Communication between processes—for example, to share resources such as database connections—is extremely awkward to program And finally, exotic programming languages may have their charm but they lack the ability to the "heavy lifting" Features such as database access or security are typically not part of the language but supplied by a non-standard third-party library That puts the programmer at the mercy of not only the implementors of the language itself but also the providers of various third-party libraries Java programmers have enjoyed the power of servlets for some time, which solves many of these problems Servlets are programmed in Java, a language that is widely supported Java has built-in features for database access, networking, multithreading, security, and so on Each servlet executes in its own thread, thus avoiding the cost of generating server processes Servlets can easily share resources such as session state and database connections The principal disadvantage of servlets is that it is plainly tedious to generate HTML All HTML must be generated programmatically, by statements that print all the text and tags In particular, that means that the pages are generated by programmers We all know what can happen when programmers try their hand at web design An increasingly popular approach in recent years has been the use of web server scripting languages such as Netscape LiveWire and Microsoft ASP (Active Server Pages) With these systems, a programmer embeds code snippets into web pages The pages themselves can be professionally designed by a web designer The web server executes the code snippets when serving the page, inserting the HTML that results from the execution of each snippet The advantage of this approach—and the reason for its popularity—is that you can get simple results very quickly But what looks like fun and great productivity early on turns out to be a maintenance nightmare later When you intermingle the presentation (the static parts of the HTML pages) and the business logic (the code snippets), it becomes very difficult to change either when the need arises Web designers will not know how how to move the code around when redesigning the pages This makes any redesign a costly affair involving frequent interaction between programmers and web designers Finally, keep in mind that you are tied into a particular web server For example, if you develop your application in ASP and later want to use Apache instead of Microsoft IIS, you are stuck The JSP technology that is the topic of this book overcomes these issues JSP has the same advantages as servlets—in fact, JSP pages are servlets You use the full power of the Java language, and not some scripting language, to implement your business logic By using beans, XML transformations, and tag libraries, JSP lets you separate the presentation logic and business logic For example, in a well-structured JSP application, you can have the same business logic with multiple interfaces, giving your users the choice to use a regular web browsers or a mobile phones that uses WAP (the wireless access protocol) This book teaches you how to build robust and scalable web applications with JSP It covers the JSP syntax, the features that JSP inherits from servlets such as session management, the interaction between servlets and beans, a number of useful Java topics such as JDBC (Java Database Connectivity) and XML Finally, and most importantly, you will learn about application partitioning and deployment—these subjects make all the difference between a quick hack and a robust application that will withstand the test of time Unlike other books, this book takes a properly JSP-centric approach, in accordance with the recommendations that Sun Microsystems makes in their Java Enterprise blueprints This is very appropriate and a major strength Where other books start out with servlets and discuss JSP as a second method for web programming, this book shows you why JSP pages have a higher position in the food chain A JSP page can everything a servlet can, but where you have to a lot of tedious programming and organizing when you use servlets, JSP has higher level capabilities that let you focus on your business problems instead In the spirit of the Core series, this book contains is plenty of real-world advice that you won't find in the online documentation The authors don't dwell on tedious syntax and boring minutiae Unlike so many computer book authors, they have done the hard work and separated the wheat from the chaff You won't waste time studying features that you won't use, but you will find good coverage of those subjects that you actually need when building real applications I am confident you will find this Core book truly useful I hope you enjoy it and have the opportunity to use it for building great web applications Cay Horstmann San Jose, August 2000 Acknowledgments This book wouldn't exist if it were not for the multitude of supportive people that have helped us throughout the process Our first praise must go to our editor, Karen McLean, for putting up with our endless barrage of questions and keeping us on course Without her help we would have been endlessly lost, trying to figure out what actually goes into creating a book Of course our reviewers, Cay Horstmann, Carl Burnham, and Glenn Kimball, deserve a special round of applause as well Their sharp eyes and bountiful comments helped us smooth the book into the more readable text that you see today Finally and maybe most important, we'd like to thank the entire Java and JSP community Java, Java Servlets, and JavaServer Pages are evolving and growing into a powerful force primarily because of the drive of countless individuals who dedicate their time to make them better These technologies are a flagship for the power of communities and open standards From Aaron When I first committed to writing this book, I knew I was expecting a little one She has very quickly become the most important thing in my life Undoubtedly, my strongest drive to complete this book was so that I could spend more time with her Zella Arden Tavistock-Thaman is my most important dedication I also want to voice my profound appreciation for the patience and understanding that Zella's mom has given me Raquella Thaman has been supportive and helpful throughout the long weekends and nights, all the while helping me keep track of the important things going on in the world around me I don't think I can truly state my love and appreciation for you, Raqui Then there is the whole Tavistock family To my parents, Daniel and Marjorie Tavistock, for always being there and being supportive To my sisters for putting up with me as a big brother and letting me rile up all the nieces and nephews Of course, I also had a great coauthor We each have our own set of skills that seem to compliment the other's and yet we work in similar ways to get to an end-goal It has been good to work with a talented and driven person like Damon It was hard work, fun, and its finally finished thank you everyone! From Damon For putting up with all of the long hours, weekends at the computer, and A.M writing sessions, I dedicate my efforts toward this book to my wonderful wife Julie Hougland Without her constant support and encouragement this book would never have been completed She is the sensation of joy I feel when I awake every morning, and the warm, comfortable feeling of contentment when I close my eyes at night I also want to thank my best friend, my daughter Abigail Nora Hougland, and my hope for the future, my little son Gibson Charles Hougland Their smiles and laughs remind me what life is all about Their curious eyes and warm embraces make my life full Special thanks goes to my parents, Christine and Bill Gollery, as well as my sister Jamie Thomas Thank you for always being there with your support and love I owe the success and happiness I have in life to the foundation you created, nurtured, and still care for I want to thank my Grandparents, Jack and Barbara Wells Nana, you built my selfconfidence by telling me I could succeed You always encouraged me to learn and more Papa, you are my role model The quiet way you are always there for the entire family You always led by example, taking care of us whenever anything was wrong and always making us feel special You have built a large and loving family Thanks to my aunt Paula Wells, whose experience, advice, and encouragement helped us from concept to appendix Your guidance made this book possible And I won't forget my coauthor Aaron, for sticking with me from my crazy idea for a book to the final pages It has been a long road, and I wouldn't have gone down it with anyone else Thanks! Chapter INTRODUCTION Topics in this Chapter: • • • • • A History of the Web JavaServer Pages The Power of Java A Simple JSP Understanding HTTP In today's environment, dynamic content is critical to the success of any Web site Users want and need very specific information tailored to their situation As the Web becomes a standard platform for enterprise computing and e-commerce, Web development steadily gets more complex Web servers are becoming Web application servers Complex databases and applications are turning up all over the Internet Content providers want a solution that is easy to create and quick to market, yet powerful and flexible JavaServer Pages (JSP) is an exciting new technology that provides powerful and efficient creation of dynamic content JSP is a presentation layer technology that allows static Web content to be mixed with Java code JSP allows the use of standard HTML, but adds the power and flexibility of the Java programming language JSP does not modify static data, so page layout and "look-and-feel" can continue to be designed with current methods This allows for a clear separation between the page design and the application JSP also enables Web applications to be broken down into separate components This allows HTML and design to be done without much knowledge of the Java code that is generating the dynamic data Businesses will no longer have to hunt down the rare software developer who understands graphic design, layout, application programming, and software design As the name implies, JSP uses the Java programming language for creating dynamic content Java's object-oriented design, platform independence, and protected-memory model allow for rapid application development Built-in networking and enterprise Application Programming Interfaces (APIs) make Java an ideal language for designing client-server applications In addition, Java allows for extremely efficient code reuse by supporting the JavaBean and Enterprise JavaBean component models 1.1 A History of the Web To understand the power of JSP pages, one must first take a look at the past approaches to creating Web pages Static Pages With a static Web page, the client requests a Web page from the server and the server responds by sending back the requested file to the client The client receives an exact replica of the page that exists on the server (See Figure 1–1) Figure 1-1 Standard HTML Document Traditional Web pages are static and unchanging Under normal conditions they will always remain the same Requests from multiple clients for the same static page should all receive the same results Dynamic Pages Since the earliest days of HTML there has been a need for handling data dynamically It may have started out as simple as providing a feedback form Today's Web site requires a lot more than static content and a feedback form Dynamic data is important to everything on the Web, from online banking to playing games The definition of dynamic content is Web pages that are created at the time they are requested, changing content based on specified criteria For example, a Web page that displays the current time is dynamic because its content changes to reflect the current time Dynamic pages are generated by an application on the server, receiving input from the client, and responding appropriately (See Figure 1–2) Figure 1-2 Dynamic HTML Document There have been several methods of generating dynamic data used over the years Understanding the other approaches and their strengths and weaknesses helps to understand JSP pages Common Gateway Interface The Common Gateway Interface (CGI) is probably the most prolific form of Web application in use today Designed early on in the Web-server era, CGI allows requests to be sent to an external program These external programs could be written in just about any programming language—most commonly C, C++, Perl, and Python While CGI is a solution for creating dynamic content on the Web, it has several facets that make it very inefficient.CGI programs typically use a large amount of system resources; not just CPU usage, but also large amounts of memory For each request sent to a CGI program, the Web server loads, runs, and unloads the entire CGI CGI programs are independent from the Web server and cannot write to the Web server's logs or find out about the capabilities of the server Additionally, CGI pages are often not readily portable to other platforms Since the implementation of CGI programs, several vendors have created unique approaches to working around its inherent limitations FastCGI, created by Open Market, is a CGI alternative that creates a single persistent process for each CGI request While this helps, there is still one process for each CGI program, and further resources are consumed if that process needs to launch an interpreter such as Perl To find out more about FastCGI visit the Fast Engine Web site at: http://www.fastengines.com/ Another method of increasing CGI performance was embedding an interpreter into the Web server This allows the Web server to precompile and prefork the CGI It also allows for native API hooks into the Web server The largest limitation associated with these approaches is that they are tied to a very specific language, platform, and Web server Some examples of this include mod_perl for the Apache Web server and PerlEx by ActiveState for the Microsoft Internet Information Server To get more information on mod_perl go to the Perl/Apache Web site at: http://perl.apache.org/ Find out more about PerlEx by visiting Active State's Web site at: http://www.activestate.com/plex/ While all of these attempts to overcome the limitations of CGI programs have improved their performance, the limitations of the CGI process itself is responsible for most of the system's drawbacks Server APIs Another method for creating dynamic Web applications is Web-server specific APIs Netscape provides the Web Application Interface or WAI (formerly NSAPI) for its server suite, and Microsoft provides ISAPI for its Internet Information Server The Apache Web server has a module-based programming interface that allows modules to be loaded within the httpd executable All of the server APIs offer tremendous speed and resource gains by integrating tightly with the native Web server Unfortunately, this also creates a solution limited to a particular platform and Web server Additionally, server API extensions can create several security issues Since the API extension runs as a part of the Web server itself, a problem with the extension could cause the Web server to crash Client-side Scripting Solutions These are a class of Web development in which the code is pushed to the user and run on the user's machine These can be very useful tools for developing dynamic content; however, they have severe limitations The client needs to support the scripting language in exactly the ways expected Differences between the way that Microsoft's Internet Explorer and Netscape's Navigator interpret a client-side script can make a dramatic difference in what is seen in the client's browser VBScript is one example of a client-side scripting language VBScript is based on Microsoft Visual Basic It is currently only supported on Microsoft Internet Explorer JavaScript, also known as JScript and ECMAScript, plays an important role in creating dynamic Web applications running completely on the client The European Computer Manufacturer's Association has recently standardized JavaScript by combining the popular versions created by Netscape and Microsoft (ECMA-262) JavaScript is limited to the Web browsers that support the language; Netscape and Opera Web browsers both support JavaScript directly, while Microsoft supports a version of the JavaScript standard called JScript JavaScript plays a very different role than JSP pages, but the two languages can be used together to create some amazing results An excellent source for more information on JavaScript is Janice Winsor and Brian Freeman's Jumping JavaScript (Pearson Technical Reference/Prentice Hall, 1998) Server-side Scripting Solutions There are several common scripting solutions to create Web applications These are scripts that are run on the server before the page is sent to the user Netscape's server-side scripting solution is called Server Side JavaScript (SSJS) In SSJS, JavaScript is executed on the server to modify HTML pages, and scripts are precompiled to improve server performance SSJS is available on several different versions of Netscape Web Servers To learn more about SSJS go to: http://developer.netscape.com/tech/javascript/ssjs/ssjs.html Microsoft servers offer Active Server Pages (ASP) ASP pages are very similar to JSP pages ASP allows developers to embed VBScript or JScript code directly into a Web page ASP pages have to be compiled every time they are run, mirroring one of the major drawbacks of CGI scripts ASP is only available to developers running Microsoft's Internet Information Server 3.0 or above By far the biggest drawback of the major scripting solutions is their proprietary nature All of the solutions discussed are dependent on either certain Web servers or specific vendors Java Servlets Java Servlets are a powerful alternative to CGI programs and scripting languages Servlets are extremely similar to the proprietary server APIs, but since they are written in the Java programming language they can be easily ported to any environment that supports the Servlet API Since they run in the Java Virtual Machine, they bypass the security problems that affect the server APIs Servlets are run inside a Servlet engine Each individual Servlet is run as a thread inside the Web server process This is a much more efficient solution than multiple server processes implemented by CGI programs By running in threads Servlets are also very scaleable, and since they are a part of the Web server process themselves they can interact closely with the Web server Servlets are extremely powerful replacements for CGI programs They can be used to extend to any type of server imaginable The built-in thread and security support make Servlets a robust tool for extending a server service All major Web servers now support Servlets The major drawback of using Java Servlets is in their power The Java programming language is at once both powerful and complicated, and learning Java is a formidable task for the average Web developer 1.2 JavaServer Pages JSP is an extremely powerful choice for Web development JSP is a technology using server-side scripting that is actually translated into Servlets and compiled before they are run This gives developers a scripting interface to create powerful Java Servlets JSP pages provide tags that allow developers to perform most dynamic content operations without writing complex Java code Advanced developers can add the full power of the Java programming language to perform advanced operations in JSP pages Template Pages Clearly, the most effective way to make a page respond dynamically would be to simply modify the static page Ideally, special sections to the page could be added that would be changed dynamically by the server In this case pages become more like a page template for the server to process before sending These are no longer normal Web pages—they are now server pages On a server page, the client requests a Web page, the server replaces some sections of a template with new data, and sends this newly modified page to the client (See Figure 1–3) Figure 1-3 Server Page Since the processing occurs on the server, the client receives what appears to be static data As far as the client is concerned there is no difference between a server page and a standard Web page This creates a solution for dynamic pages that does not consume client resources and is completely browser neutral Static Data vs Dynamic Elements Since JSP pages are designed around static pages, they can be composed of the same kind of static data as a standard Web page JSP pages use HTML or XML to build the format and layout of the page As long as a normal Web page could contain the data, so can the JSP page In order to replace sections of a page, the server needs to be able to recognize the sections it needs to change A JSP page usually has a special set of "tags" to identify a portion of the page that should be modified by the server JSP uses the